Sipu Jha
Google has released its largest Android security update in nearly eight years. With the latest security update the company has fixed around 129 vulnerabilities in the March 2026 Android Security Bulletin. The update, published this week surpassed the record set in April 2018. With this latest security update Google has addressed various flaws including the CVE-2026-21385, a Qualcomm zero-day vulnerability already being exploited in the wild. The CVE-2026-21385 flaw was discovered by Google’s Threat Analysis Group and it affects 234 Qualcomm chipsets and resides in the graphics component, It is an integer overflow issue that can lead to memory corruption. Along with this, Google has also confirmed that ‘limited, targeted exploitation,’ raising concerns that spyware vendors may be using it against high-profile individuals such as journalists, activists, or executives. Qualcomm also released fixes to manufacturers in January 2026, asking users to install updates promptly.
Other critical fixes
Apart from the zero-day, Google patched 10 critical vulnerabilities across system,framework, and kernel components. These could enable remote code execution, privilege escalation, or denial-of-service attacks without user interaction. The update is split into two patch levels:
- 2026-03-01: Fixes 63 vulnerabilities.
- 2026-03-05: Includes all earlier fixes plus 66 additional patches for kernel and hardware components from Arm, MediaTek, Unisoc, and others.
Who’s at risk
Any Android device running on Qualcomm chips is potentially vulnerable if not updated to the 2026-03-05 patch level. This covers the majority of Android smartphones and tablets worldwide.
How to install the update
Follow the below mentioned steps in order to install the update
- Go to Settings and then head to About phone section
- After this click on Android version and then select security update
- Make sure that your patch level reads 2026-03-05
- The smartphones running on Android 10 or later may also receive updates via Google Play system updates.
- In case the update is not available yet, users should avoid sideloading apps, stay cautious with email attachments, and keep Google Play Protect enabled.
For those unable to update immediately, Google advises:
- Avoiding apps from outside official app stores.
- Exercising caution with websites and email attachments.
- Keeping Google Play Protect enabled.
However, Google stresses that these are only temporary measures — the security update itself is the only real fix. Source code patches will be released to the Android Open Source Project within 48 hours of the bulletin’s publication.
English 
हिन्दी